Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 32 of 125
- 9.8 /10 CriticalCVE-2026-14992 No auth
IBM DataPower Gateway - Buffer Overflow
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow caused by improper handling of input, letting attackers potentially execute arbitrary code, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-14991 No auth
IBM DataPower Gateway - Buffer Overflow
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contains a buffer overflow caused by improper bounds checking, letting local users execute arbitrary code, exploit requires local access.
- 9.3 /10 CriticalCVE-2026-14990 No auth
IBM DataPower Gateway - Stored XSS
IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 contains a stored XSS caused by improper input sanitization in the Web UI, letting unauthenticated attackers execute arbitrary JavaScript and potentially disclose credentials within a trusted session.
- 9.8 /10 CriticalCVE-2026-14502 No auth
IBM DataPower Gateway - Authentication Bypass
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a broken authentication caused by failure to reject empty passwords during LDAP authentication, letting remote attackers obtain administrative access, exploit requires LDAP authentication.
- 9.8 /10 CriticalCVE-2026-14269 No auth
IBM DataPower Gateway - Remote Code Execution
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by heap-based buffer overflow due to improper bounds checking, letting unauthenticated remote attackers execute arbitrary code.
- 10.0 /10 CriticalCVE-2026-12260 No auth
NetBoard CRM - SQL Injection
NetBoard CRM demo platform contains a SQL injection caused by unsanitized 'user-name' POST parameter in /module/auth/recovery.php, letting attackers extract confidential information and alter data, exploit requires crafted POST requests.
- 9.8 /10 CriticalCVE-2026-107780 No auth
Dromara Skyeye - Command Injection
Dromara Skyeye contains a command injection caused by improper sanitization of the format parameter in the unauthenticated /post/TtsController/textToSpeech endpoint, letting remote attackers execute OS commands as the Skyeye service account on Windows, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-107779 No auth
Dromara Skyeye - Authentication Bypass
Dromara Skyeye contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false), letting unauthenticated attackers execute commands or stop/delete jobs on the executor host via crafted POST requests.
- 9.3 /10 CriticalCVE-2026-107726 No auth
Hazelcast - Information Disclosure & Remote Code Execution
Hazelcast < 5.4.5, < 5.5.10, and < 5.6.1 contain an information disclosure and potential remote code execution caused by improper validation of data from malicious clients, letting attackers read arbitrary memory and crash or corrupt cluster members, exploit requires attacker to connect to the cluster.
- 9.8 /10 CriticalCVE-2026-107722
fast-jwt - Authentication Bypass
fast-jwt 6.2.0 to 6.3.0 contains an authentication bypass caused by misclassification of RSA public-key text as HMAC secret due to improper PEM header detection, letting attackers sign arbitrary HS256 claims, exploit requires attacker knowledge of public key bytes.
- 9.8 /10 CriticalCVE-2026-107704 No auth
image_optimizer Ruby gem - Command Injection
image_optimizer Ruby gem 1.3.0 through 1.9.0 contains a command injection caused by improper sanitization of image path in ImageOptimizer#identify_format, letting attackers execute OS commands with Ruby process privileges, exploit requires crafted image path with shell metacharacters.
- 9.8 /10 CriticalCVE-2026-107703 No auth
@enmaso/node-convert - Command Injection
@enmaso/node-convert <= 1.0.0 contains a command injection caused by unsanitized filepath and convertTo arguments in convert.js, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-107700 No auth
dot-access - Command Injection
dot-access 0.0.3 through 1.0.0 contains a command injection caused by concatenation of crafted paths into a new Function body in index.js, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-107699 No auth
ppt2png - Command Injection
ppt2png <= 0.0.6 contains a command injection caused by unsanitized input in file name arguments to child_process.exec() in ppt2png.js, letting attackers execute OS commands with Node.js process privileges.
- 9.1 /10 CriticalCVE-2026-107640 No auth
Integrics Enswitch - Authentication Bypass
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass caused by omission of the reset parameter in /api/json/user/password/update/, letting unauthenticated attackers change account passwords and take over administrator accounts, exploit requires valid username enumeration.